Apple loves bragging about how secure its devices are. Not without reason: there are many security features you probably use daily, including code autofill, password reuse auditing, Safari built-in privacy, and more.
The same goes for developers. For example, Apple doesn't release its source code to app developers for security reasons, and iOS device owners can't modify the code on their phones themselves.
However, there are many other less-known security features Apple uses to prevent their devices from being hacked.
We will discuss how Apple handles user data protection on its devices and what security measures it takes. I've divided the article into two parts, covering popular iOS security features for user data storage and transportation.
Table of ContentHow Apple Handles Secure Data Storing |
Ever wonder how your iPhone reliably keeps your info safe from hackers and nosy apps? Let's look at three key security features for secure data storage and how they shield against real threats.
Apps are among the most critical elements of security architecture. While they can benefit users' productivity, they may also affect the system's security and user data if handled incorrectly.
That's why users are supposed to download iPhone, iPad, and iPod touch apps only from the App Store. Any company can create an iOS app, but only apps that comply with App Store guidelines will be published.
These apps run in a sandbox, a directory in which they can store data. The App Sandbox is like putting each app in its protective bubble. It stops apps from accessing stuff they shouldn't.
If an attacker tries to exploit security holes in your app, the sandbox will use a defensive mechanism that limits the app's access to files, preferences, network resources, and hardware.
Say you download a free flashlight app that's trying to steal data. Thanks to the sandbox:
Data protection features secure app files and prevent unauthorized access to them. It’s enabled as soon as the user sets a passcode for the device.
This process is automatic and hardware-accelerated, so it is unnoticeable to the user. Users read and edit files the way they always do while the encryption-decryption process happens behind the scenes.
There are four data protection levels:
If you don't choose the protection level when creating a file, iOS automatically applies the default security level.
Sure, it’s better to use the highest protection level Apple offers. However, if you need to access files in the background while the device stays locked, complete data encryption may not be the best option.
When you get a text with your credit card number:
The keychain is a secure space to store data bits in an encrypted database.
Each iOS application gets its own space in the keychain, which no other app can access. You don't need to store encryption keys in your app; you rely on the system to provide the highest security level.
Related Topic: What is Jailbreaking an iPhone? How Does It Work?
This feature is great for people who manage many online accounts and (in a perfect world) have a unique password for each. Remembering each new string of letters and numbers is impossible, and writing them down is insecure. The same goes for using one password for multiple accounts.
The keychain solves this problem by giving users a mechanism to store these chunks of data. It’s not limited to storing passwords, though. Users can also keep such information as credit card details or short notes.
You use the same password everywhere because it's easy to remember. With Keychain:
Here's a real-world scenario showing all three features in action:
Next to data safety is communication between an app and its remote counterparts.
Here are the security measures iOS offers for this case:
There's a networking feature on iOS-powered devices called App Transport Security (ATS for short). ATS requires that all connections use HTTPS and be secured with the Transport Layer Security (TLS) protocol, unlike standard HTTP connections, which aren't encrypted.
If connections don't meet security specifications, ATS blocks them. However, it can be configured to loosen up these restrictions (which Apple warns against, claiming that "it reduces the security of your app").
HTTPS connections are checked by default. The system inspects the server certificate and checks if the certificate is valid for this domain.
In theory, this should prevent the device from connecting to malicious servers. However, there are loopholes for cyber attackers to perform so-called "man-in-the-middle (MITM)" attacks. They do this by compromising a certificate authority or changing the user's device settings to trust another malicious certificate.
This way, attackers could access all messages sent between the client and the server.
TLS pinning restricts which certificates are considered valid for a particular website, ensuring the app communicates only with the verified server. iOS developers implement pinning by adding a list of valid certificates to their app bundle. The app checks if the certificate used by this server is on the list and only then communicates with the server.
End-to-end encryption provides the highest level of security for data transportation. The information is protected with a key combined with your device passcode—a detail only the owner knows.
Messages are encrypted so that only the sender or receiver can decrypt them. Neither Apple nor your services can read this data.
Details like Apple card transactions (iOS 12.4 or later), health and home data, search history, payment information, Wi-Fi passwords, and Siri information are stored in iCloud, secured by end-to-end encryption.
Apple offers iOS users quite a few stringent privacy controls and security features, including those for data storage and transportation.
Apple offers many security features and doesn't release its source code to developers, which is why its iOS operating system has long been considered more secure than Android.
Still, that doesn't mean it can't be hacked.
The best-known iOS features for data storage:
iOS has the following features for secure data transmission: